Claroline: >> Claroline >> 1.11 Security Vulnerabilities
Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.
CVSS Score
9.8
EPSS Score
0.318
Published
2022-08-25
Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with administrative rights by opening an SVG file as an administrator user.
CVSS Score
5.4
EPSS Score
0.001
Published
2022-08-25
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.
CVSS Score
6.1
EPSS Score
0.001
Published
2022-08-25
Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.
CVSS Score
5.4
EPSS Score
0.001
Published
2022-08-25
Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.11.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field in an inbox action to messaging/messagebox.php, (2) the "First name" field to auth/profile.php, or (3) the Speakers field in an rqAdd action to calendar/agenda.php.
CVSS Score
3.5
EPSS Score
0.002
Published
2014-12-26
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML via the (1) box parameter to messaging/messagebox.php, cidToEdit parameter to (2) adminregisteruser.php or (3) admin_user_course_settings.php in admin/, (4) module_id parameter to admin/module/module.php, or (5) offset parameter to admin/right/profile_list.php.
CVSS Score
4.3
EPSS Score
0.005
Published
2013-12-05